Versions in this module Expand all Collapse all v0 v0.9.0 Aug 14, 2026 Changes in this version + var ErrElevationRequired = errors.New("sandbox: Windows setup requires elevation") + var ErrJobCompletionWait = errors.New("sandbox: Windows Job completion wait failed") + var ErrRestrictedTargetChanged = errors.New("sandbox: restricted cleanup target changed") + var ErrSIDReuse = errors.New("sandbox: one-shot Windows SID entropy reused") + var ErrSetupRequired error = unavailableError("sandbox: Windows elevated setup required") + var ErrSetupStale error = unavailableError("sandbox: Windows elevated setup is stale") + func ConfigureExplicitHandleList(cmd *exec.Cmd, declared []ExplicitHandle) (cleanup func(), err error) — windows/amd64 + func CreateRestrictedToken(source xwindows.Token, restrictingSIDs []SID) (xwindows.Token, error) — windows/amd64 + func OpenRestrictedJournalAndSweep(stableScratchRoot string, cleaner RestrictedJournalCleaner) (*RestrictedJournal, RestrictedSweepReport, error) + func PlatformBackend(config Config, runtime *RestrictedRuntime) (enforce.Backend, error) — windows/amd64 + func Remove(context.Context, SetupConfig) error — darwin/amd64, js/wasm, linux/amd64 + func Remove(ctx context.Context, config SetupConfig) error — windows/amd64 + func RunInstalledBrokerService(ctx context.Context) error — windows/amd64 + func RunInstalledBrokerServiceDispatcher() error — windows/amd64 + func RunInstalledProtectedRunner() (uint32, error) — windows/amd64 + func Setup(context.Context, SetupConfig) error — darwin/amd64, js/wasm, linux/amd64 + func Setup(ctx context.Context, config SetupConfig) error — windows/amd64 + func ValidateConfig(config Config) error + func ValidateDisposableStandardUserToken(token xwindows.Token) error — windows/amd64 + type ACERole uint8 + const ACERoleAccountNormal + const ACERoleRestrictingAllow + const ACERoleRestrictingDeny + const ACERoleUnknown + type ACEType uint8 + const ACEAllow + const ACEDeny + type ACLACE struct + Access ACLAccess + Bytes []byte + Inheritable bool + Type ACEType + type ACLACEExpectation struct + Access ACLAccess + Inherited bool + Role ACERole + SID SID + type ACLAccess uint8 + const ACLExecute + const ACLRead + const ACLWrite + type ACLLeaseID [16]byte + type ACLMutation struct + func (mutation ACLMutation) ACE() ACLACE + func (mutation ACLMutation) Object() ACLObjectIdentity + func (mutation ACLMutation) Rollback() ACLRollbackMetadata + type ACLMutationRecord struct — windows/amd64 + ACE []byte + BaselineIdentical int + Object ACLObjectIdentity + Rollback ACLRollbackMetadata + type ACLMutationRecorder interface — windows/amd64 + AfterACLRollback func(ACLMutationRecord) error + BeforeACLMutation func(ACLMutationRecord) error + type ACLObjectIdentity struct + FileID [16]byte + Kind ACLObjectKind + LinkCount uint32 + ReparseTag uint32 + VolumeSerial uint64 + type ACLObjectKind uint8 + const ACLObjectDirectory + const ACLObjectFile + const ACLObjectReparsePoint + const ACLObjectUnknown + type ACLPlan struct + func BuildACLPlan(request ACLPlanRequest) (ACLPlan, error) + func (plan ACLPlan) Mutations() []ACLMutation + func (plan ACLPlan) Narrowings() []string + func (plan ACLPlan) RootIdentity() ACLObjectIdentity + func (plan ACLPlan) SID() SID + func (plan ACLPlan) SkippedReparsePoints() []ACLObjectIdentity + func (plan ACLPlan) ValidationTargets() []ACLValidationTarget + type ACLPlanEntry struct + Deny ACLAccess + Object ACLObjectIdentity + type ACLPlanRequest struct + Access ACLAccess + Entries []ACLPlanEntry + LeaseID ACLLeaseID + Root ACLObjectIdentity + SID SID + Scope ACLScope + type ACLProjection struct — windows/amd64 + func NewACLProjection(plan ACLPlan, handles []*policy.PathHandle, recorder ACLMutationRecorder) (*ACLProjection, error) + func NewACLTreeProjection(plan ACLPlan, tree *RetainedACLTree, recorder ACLMutationRecorder) (*ACLProjection, error) + func NewRestrictedACLProjection(plan ACLPlan, handles []*policy.PathHandle, journal *RestrictedJournal) (*ACLProjection, error) + func NewRestrictedACLTreeProjection(plan ACLPlan, tree *RetainedACLTree, journal *RestrictedJournal) (*ACLProjection, error) + func (projection *ACLProjection) Apply() error + func (projection *ACLProjection) Close() error + func (projection *ACLProjection) Rollback() error + type ACLRollbackMetadata struct + ACEHash [sha256.Size]byte + LeaseID ACLLeaseID + Role ACERole + SID SID + type ACLScope uint8 + const ACLScopeExact + const ACLScopeTree + const ACLScopeUnknown + type ACLTreeEntry struct — windows/amd64 + Object ACLObjectIdentity + RelativePath string + type ACLValidationTarget struct + Object ACLObjectIdentity + Required []ACLACEExpectation + type Config struct + Mode SandboxMode + StateRoot string + type ExplicitHandle struct — windows/amd64 + Access uint32 + Handle winapi.Handle + type HandleObjectIdentity struct — windows/amd64 + func CaptureHandleObjectIdentity(handle winapi.Handle) (HandleObjectIdentity, error) + func (identity HandleObjectIdentity) CompareCandidate(value, object uintptr) (sameObject, conclusive bool) + func (identity HandleObjectIdentity) Value() uintptr + type Job struct — windows/amd64 + func NewJob(options JobOptions) (_ *Job, err error) + func (job *Job) ActiveProcesses() (uint32, error) + func (job *Job) Assign(process winapi.Handle) error + func (job *Job) Close() error + func (job *Job) Handle() winapi.Handle + func (job *Job) ResourceLimitsInstalled() bool + func (job *Job) Terminate(exitCode uint32) error + func (job *Job) WaitActiveProcessesZero(ctx context.Context) error + type JobOptions struct — windows/amd64 + MaxCPUPct int + MaxMemoryBytes int64 + MaxProcesses int + Sandboxed bool + type OneShotSIDGenerator struct + func NewOneShotSIDGenerator(source io.Reader, store SIDRetirementStore) (*OneShotSIDGenerator, error) + func (generator *OneShotSIDGenerator) Next() (SID, error) + type RestrictedACLCleaner struct — windows/amd64 + func (RestrictedACLCleaner) RemoveRestrictedAllowACE(record RestrictedCleanupRecord) (bool, error) + type RestrictedCleanupRecord struct + ACE []byte + BaselineOccurrences uint32 + Object ACLObjectIdentity + Path string + Rollback ACLRollbackMetadata + type RestrictedJournal struct + func OpenRestrictedJournal(stableScratchRoot string) (*RestrictedJournal, error) + func (j *RestrictedJournal) Close() error + func (j *RestrictedJournal) CompleteCleanup(key string) error + func (j *RestrictedJournal) PrepareMutation(record RestrictedCleanupRecord) (string, error) + func (j *RestrictedJournal) Prune(pruner RestrictedPruner) error + func (j *RestrictedJournal) RetireSID(sid SID) (bool, error) + func (j *RestrictedJournal) Sweep(cleaner RestrictedJournalCleaner) (RestrictedSweepReport, error) + type RestrictedJournalCleaner interface + RemoveRestrictedAllowACE func(RestrictedCleanupRecord) (removed bool, err error) + type RestrictedPruner interface + PruneRestrictedACEs func(func(SID, ACERole, []byte) bool) error + type RestrictedRuntime struct + func AcquireRestrictedRuntime(scratchRoot string) (*RestrictedRuntime, func() error) + func NewRestrictedRuntime(scratchRoot string) *RestrictedRuntime + func (runtime *RestrictedRuntime) Close() error + type RestrictedSweepReport struct + Corrupt int + Removed int + Retained int + type RetainedACLTree struct — windows/amd64 + func EnumerateRetainedACLTree(root *policy.PathHandle) (*RetainedACLTree, error) + func (tree *RetainedACLTree) Close() error + func (tree *RetainedACLTree) Entries() []ACLTreeEntry + func (tree *RetainedACLTree) Root() ACLObjectIdentity + type SID struct + func ExecutorSID(installationID, executorID string) (SID, error) + func InstallationSID(installationID string) (SID, error) + func (sid SID) String() string + type SIDRetirementStore interface + RetireSID func(SID) (retired bool, err error) + type SandboxMode uint8 + const Auto + const Elevated + const RestrictedToken + type SetupConfig struct + HostBinary string + InstallationID string + ProxyPorts []uint16 + RuntimeEvidencePath string + StateRoot string + type SetupProblem struct + Code WindowsSetupProblemCode + Detail string + PID uint32 + Path string + Port uint16 + Resource string + type SetupStatus struct + InstallationID string + OfflineAccount string + OnlineAccount string + OwnerSID string + Problems []SetupProblem + ProxyPorts []uint16 + Ready bool + Version uint32 + func Inspect(context.Context, SetupConfig) (SetupStatus, error) + func Inspect(ctx context.Context, config SetupConfig) (SetupStatus, error) + type WindowsSetupProblemCode uint16 + const SetupProblemAccountMissing + const SetupProblemCredentialUnavailable + const SetupProblemFirewallOverridden + const SetupProblemFirewallRuleChanged + const SetupProblemHostBinaryStale + const SetupProblemLeaseRecoveryPending + const SetupProblemManifestMissing + const SetupProblemOwnerMismatch + const SetupProblemPortInUse + const SetupProblemProtocolMismatch + const SetupProblemRuntimeBaselineGap + const SetupProblemServiceUnavailable + const SetupProblemUnknown v0.8.1 Aug 11, 2026 v0.8.0 Aug 11, 2026 v0.7.0 Aug 7, 2026 v0.6.1 Aug 7, 2026 v0.6.0 Aug 7, 2026 v0.5.1 Aug 5, 2026 v0.5.0 Jul 30, 2026 v0.4.0 Jul 28, 2026
Go to main page